{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Timesketch Sigma rule from file to Database notebook\n",
    "\n",
    "This notebook will help adding one Sigma rule from disk to the Timesketch Sigma rule database."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [],
   "source": [
    "!pip install -q timesketch_api_client"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[33mWARNING: Skipping timesketch_api_client as it is not installed.\u001b[0m\u001b[33m\n",
      "\u001b[0m"
     ]
    }
   ],
   "source": [
    "!pip uninstall -y timesketch_api_client"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import sys\n",
    "\n",
    "MODULE_FULL_PATH = '/usr/local/google/home/jaegeral/dev/timesketch/api_client/python/'\n",
    "\n",
    "sys.path.insert(1, MODULE_FULL_PATH)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "running build\n",
      "running install\n",
      "/usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages/setuptools/command/install.py:34: SetuptoolsDeprecationWarning: setup.py install is deprecated. Use build and pip and other standards-based tools.\n",
      "  warnings.warn(\n",
      "/usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages/setuptools/command/easy_install.py:158: EasyInstallDeprecationWarning: easy_install command is deprecated. Use build and pip and other standards-based tools.\n",
      "  warnings.warn(\n",
      "Checking .pth file support in /usr/local/google/home/jaegeral/.local/lib/python3.10/site-packages/\n",
      "/usr/local/google/home/jaegeral/dev/timesketch/.venv/bin/python3 -E -c pass\n",
      "TEST FAILED: /usr/local/google/home/jaegeral/.local/lib/python3.10/site-packages/ does NOT support .pth files\n",
      "bad install directory or PYTHONPATH\n",
      "\n",
      "You are attempting to install a package to a directory that is not\n",
      "on PYTHONPATH and which Python does not read \".pth\" files from.  The\n",
      "installation directory you specified (via --install-dir, --prefix, or\n",
      "the distutils default setting) was:\n",
      "\n",
      "    /usr/local/google/home/jaegeral/.local/lib/python3.10/site-packages/\n",
      "\n",
      "and your PYTHONPATH environment variable currently contains:\n",
      "\n",
      "    '/usr/local/buildtools/current/sitecustomize'\n",
      "\n",
      "Here are some of your options for correcting the problem:\n",
      "\n",
      "* You can choose a different installation directory, i.e., one that is\n",
      "  on PYTHONPATH or supports .pth files\n",
      "\n",
      "* You can add the installation directory to the PYTHONPATH environment\n",
      "  variable.  (It must then also be on PYTHONPATH whenever you run\n",
      "  Python and want to use the package(s) you are installing.)\n",
      "\n",
      "* You can set up the installation directory to support \".pth\" files by\n",
      "  using one of the approaches described here:\n",
      "\n",
      "  https://setuptools.pypa.io/en/latest/deprecated/easy_install.html#custom-installation-locations\n",
      "\n",
      "\n",
      "Please make the appropriate changes for your system and try again.\n",
      "running bdist_egg\n",
      "running egg_info\n",
      "writing timesketch_api_client.egg-info/PKG-INFO\n",
      "writing dependency_links to timesketch_api_client.egg-info/dependency_links.txt\n",
      "writing requirements to timesketch_api_client.egg-info/requires.txt\n",
      "writing top-level names to timesketch_api_client.egg-info/top_level.txt\n",
      "reading manifest file 'timesketch_api_client.egg-info/SOURCES.txt'\n",
      "writing manifest file 'timesketch_api_client.egg-info/SOURCES.txt'\n",
      "installing library code to build/bdist.linux-x86_64/egg\n",
      "running install_lib\n",
      "warning: install_lib: 'build/lib' does not exist -- no Python modules to install\n",
      "\n",
      "creating build/bdist.linux-x86_64/egg\n",
      "creating build/bdist.linux-x86_64/egg/EGG-INFO\n",
      "copying timesketch_api_client.egg-info/PKG-INFO -> build/bdist.linux-x86_64/egg/EGG-INFO\n",
      "copying timesketch_api_client.egg-info/SOURCES.txt -> build/bdist.linux-x86_64/egg/EGG-INFO\n",
      "copying timesketch_api_client.egg-info/dependency_links.txt -> build/bdist.linux-x86_64/egg/EGG-INFO\n",
      "copying timesketch_api_client.egg-info/not-zip-safe -> build/bdist.linux-x86_64/egg/EGG-INFO\n",
      "copying timesketch_api_client.egg-info/requires.txt -> build/bdist.linux-x86_64/egg/EGG-INFO\n",
      "copying timesketch_api_client.egg-info/top_level.txt -> build/bdist.linux-x86_64/egg/EGG-INFO\n",
      "creating 'dist/timesketch_api_client-20221005-py3.10.egg' and adding 'build/bdist.linux-x86_64/egg' to it\n",
      "removing 'build/bdist.linux-x86_64/egg' (and everything under it)\n",
      "Processing timesketch_api_client-20221005-py3.10.egg\n",
      "creating /usr/local/google/home/jaegeral/.local/lib/python3.10/site-packages/timesketch_api_client-20221005-py3.10.egg\n",
      "Extracting timesketch_api_client-20221005-py3.10.egg to /usr/local/google/home/jaegeral/.local/lib/python3.10/site-packages\n",
      "\n",
      "Installed /usr/local/google/home/jaegeral/.local/lib/python3.10/site-packages/timesketch_api_client-20221005-py3.10.egg\n",
      "Processing dependencies for timesketch-api-client==20221005\n",
      "Searching for requests==2.28.1\n",
      "Best match: requests 2.28.1\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for pandas==1.4.4\n",
      "Best match: pandas 1.4.4\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for networkx==2.8.6\n",
      "Best match: networkx 2.8.6\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for google-auth-oauthlib==0.5.3\n",
      "Best match: google-auth-oauthlib 0.5.3\n",
      "Installing google-oauthlib-tool script to /usr/local/google/home/jaegeral/.local/bin\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for google-auth==2.11.0\n",
      "Best match: google-auth 2.11.0\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for cryptography==38.0.1\n",
      "Best match: cryptography 38.0.1\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for beautifulsoup4==4.11.1\n",
      "Best match: beautifulsoup4 4.11.1\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for altair==4.2.0\n",
      "Best match: altair 4.2.0\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for certifi==2022.6.15.2\n",
      "Best match: certifi 2022.6.15.2\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for charset-normalizer==2.1.1\n",
      "Best match: charset-normalizer 2.1.1\n",
      "Installing normalizer script to /usr/local/google/home/jaegeral/.local/bin\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for urllib3==1.26.12\n",
      "Best match: urllib3 1.26.12\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for idna==3.4\n",
      "Best match: idna 3.4\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for pytz==2022.2.1\n",
      "Best match: pytz 2022.2.1\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for python-dateutil==2.8.2\n",
      "Best match: python-dateutil 2.8.2\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for numpy==1.23.3\n",
      "Best match: numpy 1.23.3\n",
      "Installing f2py script to /usr/local/google/home/jaegeral/.local/bin\n",
      "Installing f2py3 script to /usr/local/google/home/jaegeral/.local/bin\n",
      "Installing f2py3.10 script to /usr/local/google/home/jaegeral/.local/bin\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for requests-oauthlib==1.3.1\n",
      "Best match: requests-oauthlib 1.3.1\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for rsa==4.9\n",
      "Best match: rsa 4.9\n",
      "Installing pyrsa-decrypt script to /usr/local/google/home/jaegeral/.local/bin\n",
      "Installing pyrsa-encrypt script to /usr/local/google/home/jaegeral/.local/bin\n",
      "Installing pyrsa-keygen script to /usr/local/google/home/jaegeral/.local/bin\n",
      "Installing pyrsa-priv2pub script to /usr/local/google/home/jaegeral/.local/bin\n",
      "Installing pyrsa-sign script to /usr/local/google/home/jaegeral/.local/bin\n",
      "Installing pyrsa-verify script to /usr/local/google/home/jaegeral/.local/bin\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for cachetools==5.2.0\n",
      "Best match: cachetools 5.2.0\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for pyasn1-modules==0.2.8\n",
      "Best match: pyasn1-modules 0.2.8\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for six==1.16.0\n",
      "Best match: six 1.16.0\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for cffi==1.15.1\n",
      "Best match: cffi 1.15.1\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for soupsieve==2.3.2.post1\n",
      "Best match: soupsieve 2.3.2.post1\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for toolz==0.12.0\n",
      "Best match: toolz 0.12.0\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for jsonschema==4.16.0\n",
      "Best match: jsonschema 4.16.0\n",
      "Installing jsonschema script to /usr/local/google/home/jaegeral/.local/bin\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for entrypoints==0.4\n",
      "Best match: entrypoints 0.4\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for Jinja2==3.1.2\n",
      "Best match: Jinja2 3.1.2\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for oauthlib==3.1.0\n",
      "Best match: oauthlib 3.1.0\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for pyasn1==0.4.8\n",
      "Best match: pyasn1 0.4.8\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for pycparser==2.21\n",
      "Best match: pycparser 2.21\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for attrs==22.1.0\n",
      "Best match: attrs 22.1.0\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for pyrsistent==0.18.1\n",
      "Best match: pyrsistent 0.18.1\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Searching for MarkupSafe==2.1.1\n",
      "Best match: MarkupSafe 2.1.1\n",
      "\n",
      "Using /usr/local/google/home/jaegeral/dev/timesketch/.venv/lib/python3.10/site-packages\n",
      "Finished processing dependencies for timesketch-api-client==20221005\n"
     ]
    }
   ],
   "source": [
    "!python3 /usr/local/google/home/jaegeral/dev/timesketch/api_client/python/setup.py build && python3 /usr/local/google/home/jaegeral/dev/timesketch/api_client/python/setup.py install --user"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [],
   "source": [
    "import json\n",
    "\n",
    "from timesketch_api_client import config\n",
    "from timesketch_api_client import sketch\n",
    "from timesketch_api_client import timeline\n",
    "from timesketch_api_client import analyzer\n",
    "from timesketch_api_client import search\n",
    "\n",
    "from timesketch_import_client import helper\n",
    "from timesketch_import_client import importer"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "If an error occurs, you might need to remove `rm ~/.timesketch*` and re-run the following command"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [],
   "source": [
    "ts_client = config.get_client()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Sketch name: aaa (1)\n"
     ]
    }
   ],
   "source": [
    "sketches = [(x.id, x.name) for x in ts_client.list_sketches()]\n",
    "for sketch in sketches:\n",
    "    print(f\"Sketch name: {sketch[1]} ({sketch[0]})\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Using sketch ID 1\n",
      "{\n",
      "    \"meta\": {\n",
      "        \"aggregators\": {\n",
      "            \"field_bucket\": {\n",
      "                \"description\": \"Aggregating values of a particular field\",\n",
      "                \"display_name\": \"Terms Aggregation\",\n",
      "                \"form_fields\": [\n",
      "                    {\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"Chart type to render\",\n",
      "                        \"name\": \"supported_charts\",\n",
      "                        \"options\": [\n",
      "                            \"table\",\n",
      "                            \"hbarchart\",\n",
      "                            \"barchart\",\n",
      "                            \"linechart\",\n",
      "                            \"circlechart\"\n",
      "                        ],\n",
      "                        \"type\": \"ts-dynamic-form-select-input\"\n",
      "                    },\n",
      "                    {\n",
      "                        \"default_value\": \"\",\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"What field to aggregate on\",\n",
      "                        \"name\": \"field\",\n",
      "                        \"placeholder\": \"Enter a field to aggregate\",\n",
      "                        \"type\": \"ts-dynamic-form-text-input\"\n",
      "                    },\n",
      "                    {\n",
      "                        \"default_value\": \"\",\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"ISO formatted timestamp for the start time of the aggregated data\",\n",
      "                        \"name\": \"start_time\",\n",
      "                        \"placeholder\": \"Enter a start date for the aggregation\",\n",
      "                        \"type\": \"ts-dynamic-form-datetime-input\"\n",
      "                    },\n",
      "                    {\n",
      "                        \"default_value\": \"\",\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"ISO formatted end time for the aggregation\",\n",
      "                        \"name\": \"end_time\",\n",
      "                        \"placeholder\": \"Enter an end date for the aggregation\",\n",
      "                        \"type\": \"ts-dynamic-form-datetime-input\"\n",
      "                    },\n",
      "                    {\n",
      "                        \"default_value\": \"10\",\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"Number of results to return\",\n",
      "                        \"name\": \"limit\",\n",
      "                        \"placeholder\": \"Enter number of results to return\",\n",
      "                        \"type\": \"ts-dynamic-form-text-input\"\n",
      "                    }\n",
      "                ]\n",
      "            },\n",
      "            \"query_bucket\": {\n",
      "                \"description\": \"Aggregating values of a field after applying a filter\",\n",
      "                \"display_name\": \"Filtered Terms Aggregation\",\n",
      "                \"form_fields\": [\n",
      "                    {\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"Chart type to render\",\n",
      "                        \"name\": \"supported_charts\",\n",
      "                        \"options\": [\n",
      "                            \"table\",\n",
      "                            \"hbarchart\",\n",
      "                            \"barchart\",\n",
      "                            \"linechart\",\n",
      "                            \"circlechart\"\n",
      "                        ],\n",
      "                        \"type\": \"ts-dynamic-form-select-input\"\n",
      "                    },\n",
      "                    {\n",
      "                        \"default_value\": \"\",\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"The filter query to narrow down the result set\",\n",
      "                        \"name\": \"query_string\",\n",
      "                        \"placeholder\": \"Query\",\n",
      "                        \"type\": \"ts-dynamic-form-text-input\"\n",
      "                    },\n",
      "                    {\n",
      "                        \"default_value\": \"\",\n",
      "                        \"display\": false,\n",
      "                        \"label\": \"The filter query DSL to narrow down the result\",\n",
      "                        \"name\": \"query_dsl\",\n",
      "                        \"placeholder\": \"Query DSL\",\n",
      "                        \"type\": \"ts-dynamic-form-text-input\"\n",
      "                    },\n",
      "                    {\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"What field to aggregate.\",\n",
      "                        \"name\": \"field\",\n",
      "                        \"type\": \"ts-dynamic-form-text-input\"\n",
      "                    },\n",
      "                    {\n",
      "                        \"default_value\": \"\",\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"ISO formatted timestamp for the start time of the aggregated data\",\n",
      "                        \"name\": \"start_time\",\n",
      "                        \"placeholder\": \"Enter a start date for the aggregation\",\n",
      "                        \"type\": \"ts-dynamic-form-datetime-input\"\n",
      "                    },\n",
      "                    {\n",
      "                        \"default_value\": \"\",\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"ISO formatted end time for the aggregation\",\n",
      "                        \"name\": \"end_time\",\n",
      "                        \"placeholder\": \"Enter an end date for the aggregation\",\n",
      "                        \"type\": \"ts-dynamic-form-datetime-input\"\n",
      "                    },\n",
      "                    {\n",
      "                        \"default_value\": \"10\",\n",
      "                        \"display\": true,\n",
      "                        \"label\": \"Number of results to return\",\n",
      "                        \"name\": \"limit\",\n",
      "                        \"placeholder\": \"Enter number of results to return\",\n",
      "                        \"type\": \"ts-dynamic-form-text-input\"\n",
      "                    }\n",
      "                ]\n",
      "            }\n",
      "        },\n",
      "        \"attributes\": {},\n",
      "        \"collaborators\": {\n",
      "            \"groups\": [],\n",
      "            \"users\": []\n",
      "        },\n",
      "        \"emojis\": {\n",
      "            \"&#x1F194\": \"Account ID\",\n",
      "            \"&#x1F1E6&#x1F1E8\": \"Ascension Island\",\n",
      "            \"&#x1F1E6&#x1F1E9\": \"Andorra\",\n",
      "            \"&#x1F1E6&#x1F1EA\": \"United Arab Emirates\",\n",
      "            \"&#x1F1E6&#x1F1EB\": \"Afghanistan\",\n",
      "            \"&#x1F1E6&#x1F1EC\": \"Antigua & Barbuda\",\n",
      "            \"&#x1F1E6&#x1F1EE\": \"Anguilla\",\n",
      "            \"&#x1F1E6&#x1F1F1\": \"Albania\",\n",
      "            \"&#x1F1E6&#x1F1F2\": \"Armenia\",\n",
      "            \"&#x1F1E6&#x1F1F4\": \"Angola\",\n",
      "            \"&#x1F1E6&#x1F1F6\": \"Antarctica\",\n",
      "            \"&#x1F1E6&#x1F1F7\": \"Argentina\",\n",
      "            \"&#x1F1E6&#x1F1F8\": \"American Samoa\",\n",
      "            \"&#x1F1E6&#x1F1F9\": \"Austria\",\n",
      "            \"&#x1F1E6&#x1F1FA\": \"Australia\",\n",
      "            \"&#x1F1E6&#x1F1FC\": \"Aruba\",\n",
      "            \"&#x1F1E6&#x1F1FD\": \"\\u00c5land Islands\",\n",
      "            \"&#x1F1E6&#x1F1FF\": \"Azerbaijan\",\n",
      "            \"&#x1F1E7&#x1F1E6\": \"Bosnia & Herzegovina\",\n",
      "            \"&#x1F1E7&#x1F1E7\": \"Barbados\",\n",
      "            \"&#x1F1E7&#x1F1E9\": \"Bangladesh\",\n",
      "            \"&#x1F1E7&#x1F1EA\": \"Belgium\",\n",
      "            \"&#x1F1E7&#x1F1EB\": \"Burkina Faso\",\n",
      "            \"&#x1F1E7&#x1F1EC\": \"Bulgaria\",\n",
      "            \"&#x1F1E7&#x1F1ED\": \"Bahrain\",\n",
      "            \"&#x1F1E7&#x1F1EE\": \"Burundi\",\n",
      "            \"&#x1F1E7&#x1F1EF\": \"Benin\",\n",
      "            \"&#x1F1E7&#x1F1F1\": \"St. Barth\\u00e9lemy\",\n",
      "            \"&#x1F1E7&#x1F1F2\": \"Bermuda\",\n",
      "            \"&#x1F1E7&#x1F1F3\": \"Brunei\",\n",
      "            \"&#x1F1E7&#x1F1F4\": \"Bolivia\",\n",
      "            \"&#x1F1E7&#x1F1F6\": \"Caribbean Netherlands\",\n",
      "            \"&#x1F1E7&#x1F1F7\": \"Brazil\",\n",
      "            \"&#x1F1E7&#x1F1F8\": \"Bahamas\",\n",
      "            \"&#x1F1E7&#x1F1F9\": \"Bhutan\",\n",
      "            \"&#x1F1E7&#x1F1FB\": \"Bouvet Island\",\n",
      "            \"&#x1F1E7&#x1F1FC\": \"Botswana\",\n",
      "            \"&#x1F1E7&#x1F1FE\": \"Belarus\",\n",
      "            \"&#x1F1E7&#x1F1FF\": \"Belize\",\n",
      "            \"&#x1F1E8&#x1F1E6\": \"Canada\",\n",
      "            \"&#x1F1E8&#x1F1E8\": \"Cocos (Keeling) Islands\",\n",
      "            \"&#x1F1E8&#x1F1E9\": \"Congo - Kinshasa\",\n",
      "            \"&#x1F1E8&#x1F1EB\": \"Central African Republic\",\n",
      "            \"&#x1F1E8&#x1F1EC\": \"Congo - Brazzaville\",\n",
      "            \"&#x1F1E8&#x1F1ED\": \"Switzerland\",\n",
      "            \"&#x1F1E8&#x1F1EE\": \"C\\u00f4te d\\u2019Ivoire\",\n",
      "            \"&#x1F1E8&#x1F1F0\": \"Cook Islands\",\n",
      "            \"&#x1F1E8&#x1F1F1\": \"Chile\",\n",
      "            \"&#x1F1E8&#x1F1F2\": \"Cameroon\",\n",
      "            \"&#x1F1E8&#x1F1F3\": \"China\",\n",
      "            \"&#x1F1E8&#x1F1F4\": \"Colombia\",\n",
      "            \"&#x1F1E8&#x1F1F5\": \"Clipperton Island\",\n",
      "            \"&#x1F1E8&#x1F1F7\": \"Costa Rica\",\n",
      "            \"&#x1F1E8&#x1F1FA\": \"Cuba\",\n",
      "            \"&#x1F1E8&#x1F1FB\": \"Cape Verde\",\n",
      "            \"&#x1F1E8&#x1F1FC\": \"Cura\\u00e7ao\",\n",
      "            \"&#x1F1E8&#x1F1FD\": \"Christmas Island\",\n",
      "            \"&#x1F1E8&#x1F1FE\": \"Cyprus\",\n",
      "            \"&#x1F1E8&#x1F1FF\": \"Czechia\",\n",
      "            \"&#x1F1E9&#x1F1EA\": \"Germany\",\n",
      "            \"&#x1F1E9&#x1F1EC\": \"Diego Garcia\",\n",
      "            \"&#x1F1E9&#x1F1EF\": \"Djibouti\",\n",
      "            \"&#x1F1E9&#x1F1F0\": \"Denmark\",\n",
      "            \"&#x1F1E9&#x1F1F2\": \"Dominica\",\n",
      "            \"&#x1F1E9&#x1F1F4\": \"Dominican Republic\",\n",
      "            \"&#x1F1E9&#x1F1FF\": \"Algeria\",\n",
      "            \"&#x1F1EA&#x1F1E6\": \"Ceuta & Melilla\",\n",
      "            \"&#x1F1EA&#x1F1E8\": \"Ecuador\",\n",
      "            \"&#x1F1EA&#x1F1EA\": \"Estonia\",\n",
      "            \"&#x1F1EA&#x1F1EC\": \"Egypt\",\n",
      "            \"&#x1F1EA&#x1F1ED\": \"Western Sahara\",\n",
      "            \"&#x1F1EA&#x1F1F7\": \"Eritrea\",\n",
      "            \"&#x1F1EA&#x1F1F8\": \"Spain\",\n",
      "            \"&#x1F1EA&#x1F1F9\": \"Ethiopia\",\n",
      "            \"&#x1F1EA&#x1F1FA\": \"European Union\",\n",
      "            \"&#x1F1EB&#x1F1EE\": \"Finland\",\n",
      "            \"&#x1F1EB&#x1F1EF\": \"Fiji\",\n",
      "            \"&#x1F1EB&#x1F1F0\": \"Falkland Islands\",\n",
      "            \"&#x1F1EB&#x1F1F2\": \"Micronesia\",\n",
      "            \"&#x1F1EB&#x1F1F4\": \"Faroe Islands\",\n",
      "            \"&#x1F1EB&#x1F1F7\": \"France\",\n",
      "            \"&#x1F1EC&#x1F1E6\": \"Gabon\",\n",
      "            \"&#x1F1EC&#x1F1E7\": \"United Kingdom\",\n",
      "            \"&#x1F1EC&#x1F1E9\": \"Grenada\",\n",
      "            \"&#x1F1EC&#x1F1EA\": \"Georgia\",\n",
      "            \"&#x1F1EC&#x1F1EB\": \"French Guiana\",\n",
      "            \"&#x1F1EC&#x1F1EC\": \"Guernsey\",\n",
      "            \"&#x1F1EC&#x1F1ED\": \"Ghana\",\n",
      "            \"&#x1F1EC&#x1F1EE\": \"Gibraltar\",\n",
      "            \"&#x1F1EC&#x1F1F1\": \"Greenland\",\n",
      "            \"&#x1F1EC&#x1F1F2\": \"Gambia\",\n",
      "            \"&#x1F1EC&#x1F1F3\": \"Guinea\",\n",
      "            \"&#x1F1EC&#x1F1F5\": \"Guadeloupe\",\n",
      "            \"&#x1F1EC&#x1F1F6\": \"Equatorial Guinea\",\n",
      "            \"&#x1F1EC&#x1F1F7\": \"Greece\",\n",
      "            \"&#x1F1EC&#x1F1F8\": \"South Georgia & South Sandwich Islands\",\n",
      "            \"&#x1F1EC&#x1F1F9\": \"Guatemala\",\n",
      "            \"&#x1F1EC&#x1F1FA\": \"Guam\",\n",
      "            \"&#x1F1EC&#x1F1FC\": \"Guinea-Bissau\",\n",
      "            \"&#x1F1EC&#x1F1FE\": \"Guyana\",\n",
      "            \"&#x1F1ED&#x1F1F0\": \"Hong Kong SAR China\",\n",
      "            \"&#x1F1ED&#x1F1F2\": \"Heard & McDonald Islands\",\n",
      "            \"&#x1F1ED&#x1F1F3\": \"Honduras\",\n",
      "            \"&#x1F1ED&#x1F1F7\": \"Croatia\",\n",
      "            \"&#x1F1ED&#x1F1F9\": \"Haiti\",\n",
      "            \"&#x1F1ED&#x1F1FA\": \"Hungary\",\n",
      "            \"&#x1F1EE&#x1F1E8\": \"Canary Islands\",\n",
      "            \"&#x1F1EE&#x1F1E9\": \"Indonesia\",\n",
      "            \"&#x1F1EE&#x1F1EA\": \"Ireland\",\n",
      "            \"&#x1F1EE&#x1F1F1\": \"Israel\",\n",
      "            \"&#x1F1EE&#x1F1F2\": \"Isle of Man\",\n",
      "            \"&#x1F1EE&#x1F1F3\": \"India\",\n",
      "            \"&#x1F1EE&#x1F1F4\": \"British Indian Ocean Territory\",\n",
      "            \"&#x1F1EE&#x1F1F6\": \"Iraq\",\n",
      "            \"&#x1F1EE&#x1F1F7\": \"Iran\",\n",
      "            \"&#x1F1EE&#x1F1F8\": \"Iceland\",\n",
      "            \"&#x1F1EE&#x1F1F9\": \"Italy\",\n",
      "            \"&#x1F1EF&#x1F1EA\": \"Jersey\",\n",
      "            \"&#x1F1EF&#x1F1F2\": \"Jamaica\",\n",
      "            \"&#x1F1EF&#x1F1F4\": \"Jordan\",\n",
      "            \"&#x1F1EF&#x1F1F5\": \"Japan\",\n",
      "            \"&#x1F1F0&#x1F1EA\": \"Kenya\",\n",
      "            \"&#x1F1F0&#x1F1EC\": \"Kyrgyzstan\",\n",
      "            \"&#x1F1F0&#x1F1ED\": \"Cambodia\",\n",
      "            \"&#x1F1F0&#x1F1EE\": \"Kiribati\",\n",
      "            \"&#x1F1F0&#x1F1F2\": \"Comoros\",\n",
      "            \"&#x1F1F0&#x1F1F3\": \"St. Kitts & Nevis\",\n",
      "            \"&#x1F1F0&#x1F1F5\": \"North Korea\",\n",
      "            \"&#x1F1F0&#x1F1F7\": \"South Korea\",\n",
      "            \"&#x1F1F0&#x1F1FC\": \"Kuwait\",\n",
      "            \"&#x1F1F0&#x1F1FE\": \"Cayman Islands\",\n",
      "            \"&#x1F1F0&#x1F1FF\": \"Kazakhstan\",\n",
      "            \"&#x1F1F1&#x1F1E6\": \"Laos\",\n",
      "            \"&#x1F1F1&#x1F1E7\": \"Lebanon\",\n",
      "            \"&#x1F1F1&#x1F1E8\": \"St. Lucia\",\n",
      "            \"&#x1F1F1&#x1F1EE\": \"Liechtenstein\",\n",
      "            \"&#x1F1F1&#x1F1F0\": \"Sri Lanka\",\n",
      "            \"&#x1F1F1&#x1F1F7\": \"Liberia\",\n",
      "            \"&#x1F1F1&#x1F1F8\": \"Lesotho\",\n",
      "            \"&#x1F1F1&#x1F1F9\": \"Lithuania\",\n",
      "            \"&#x1F1F1&#x1F1FA\": \"Luxembourg\",\n",
      "            \"&#x1F1F1&#x1F1FB\": \"Latvia\",\n",
      "            \"&#x1F1F1&#x1F1FE\": \"Libya\",\n",
      "            \"&#x1F1F2&#x1F1E6\": \"Morocco\",\n",
      "            \"&#x1F1F2&#x1F1E8\": \"Monaco\",\n",
      "            \"&#x1F1F2&#x1F1E9\": \"Moldova\",\n",
      "            \"&#x1F1F2&#x1F1EA\": \"Montenegro\",\n",
      "            \"&#x1F1F2&#x1F1EB\": \"St. Martin\",\n",
      "            \"&#x1F1F2&#x1F1EC\": \"Madagascar\",\n",
      "            \"&#x1F1F2&#x1F1ED\": \"Marshall Islands\",\n",
      "            \"&#x1F1F2&#x1F1F0\": \"Macedonia\",\n",
      "            \"&#x1F1F2&#x1F1F1\": \"Mali\",\n",
      "            \"&#x1F1F2&#x1F1F2\": \"Myanmar (Burma)\",\n",
      "            \"&#x1F1F2&#x1F1F3\": \"Mongolia\",\n",
      "            \"&#x1F1F2&#x1F1F4\": \"Macao SAR China\",\n",
      "            \"&#x1F1F2&#x1F1F5\": \"Northern Mariana Islands\",\n",
      "            \"&#x1F1F2&#x1F1F6\": \"Martinique\",\n",
      "            \"&#x1F1F2&#x1F1F7\": \"Mauritania\",\n",
      "            \"&#x1F1F2&#x1F1F8\": \"Montserrat\",\n",
      "            \"&#x1F1F2&#x1F1F9\": \"Malta\",\n",
      "            \"&#x1F1F2&#x1F1FA\": \"Mauritius\",\n",
      "            \"&#x1F1F2&#x1F1FB\": \"Maldives\",\n",
      "            \"&#x1F1F2&#x1F1FC\": \"Malawi\",\n",
      "            \"&#x1F1F2&#x1F1FD\": \"Mexico\",\n",
      "            \"&#x1F1F2&#x1F1FE\": \"Malaysia\",\n",
      "            \"&#x1F1F2&#x1F1FF\": \"Mozambique\",\n",
      "            \"&#x1F1F3&#x1F1E6\": \"Namibia\",\n",
      "            \"&#x1F1F3&#x1F1E8\": \"New Caledonia\",\n",
      "            \"&#x1F1F3&#x1F1EA\": \"Niger\",\n",
      "            \"&#x1F1F3&#x1F1EB\": \"Norfolk Island\",\n",
      "            \"&#x1F1F3&#x1F1EC\": \"Nigeria\",\n",
      "            \"&#x1F1F3&#x1F1EE\": \"Nicaragua\",\n",
      "            \"&#x1F1F3&#x1F1F1\": \"Netherlands\",\n",
      "            \"&#x1F1F3&#x1F1F4\": \"Norway\",\n",
      "            \"&#x1F1F3&#x1F1F5\": \"Nepal\",\n",
      "            \"&#x1F1F3&#x1F1F7\": \"Nauru\",\n",
      "            \"&#x1F1F3&#x1F1FA\": \"Niue\",\n",
      "            \"&#x1F1F3&#x1F1FF\": \"New Zealand\",\n",
      "            \"&#x1F1F4&#x1F1F2\": \"Oman \",\n",
      "            \"&#x1F1F5&#x1F1E6\": \"Panama\",\n",
      "            \"&#x1F1F5&#x1F1EA\": \"Peru\",\n",
      "            \"&#x1F1F5&#x1F1EB\": \"French Polynesia\",\n",
      "            \"&#x1F1F5&#x1F1EC\": \"Papua New Guinea\",\n",
      "            \"&#x1F1F5&#x1F1ED\": \"Philippines\",\n",
      "            \"&#x1F1F5&#x1F1F0\": \"Pakistan\",\n",
      "            \"&#x1F1F5&#x1F1F1\": \"Poland\",\n",
      "            \"&#x1F1F5&#x1F1F2\": \"St. Pierre & Miquelon\",\n",
      "            \"&#x1F1F5&#x1F1F3\": \"Pitcairn Islands\",\n",
      "            \"&#x1F1F5&#x1F1F7\": \"Puerto Rico\",\n",
      "            \"&#x1F1F5&#x1F1F8\": \"Palestinian Territories\",\n",
      "            \"&#x1F1F5&#x1F1F9\": \"Portugal\",\n",
      "            \"&#x1F1F5&#x1F1FC\": \"Palau\",\n",
      "            \"&#x1F1F5&#x1F1FE\": \"Paraguay\",\n",
      "            \"&#x1F1F6&#x1F1E6\": \"Qatar\",\n",
      "            \"&#x1F1F7&#x1F1EA\": \"R\\u00e9union\",\n",
      "            \"&#x1F1F7&#x1F1F4\": \"Romania\",\n",
      "            \"&#x1F1F7&#x1F1F8\": \"Serbia\",\n",
      "            \"&#x1F1F7&#x1F1FA\": \"Russia\",\n",
      "            \"&#x1F1F7&#x1F1FC\": \"Rwanda\",\n",
      "            \"&#x1F1F8&#x1F1E6\": \"Saudi Arabia\",\n",
      "            \"&#x1F1F8&#x1F1E7\": \"Solomon Islands\",\n",
      "            \"&#x1F1F8&#x1F1E8\": \"Seychelles\",\n",
      "            \"&#x1F1F8&#x1F1E9\": \"Sudan\",\n",
      "            \"&#x1F1F8&#x1F1EA\": \"Sweden\",\n",
      "            \"&#x1F1F8&#x1F1EC\": \"Singapore\",\n",
      "            \"&#x1F1F8&#x1F1ED\": \"St. Helena\",\n",
      "            \"&#x1F1F8&#x1F1EE\": \"Slovenia\",\n",
      "            \"&#x1F1F8&#x1F1EF\": \"Svalbard & Jan Mayen\",\n",
      "            \"&#x1F1F8&#x1F1F0\": \"Slovakia\",\n",
      "            \"&#x1F1F8&#x1F1F1\": \"Sierra Leone\",\n",
      "            \"&#x1F1F8&#x1F1F2\": \"San Marino\",\n",
      "            \"&#x1F1F8&#x1F1F3\": \"Senegal\",\n",
      "            \"&#x1F1F8&#x1F1F4\": \"Somalia\",\n",
      "            \"&#x1F1F8&#x1F1F7\": \"Suriname\",\n",
      "            \"&#x1F1F8&#x1F1F8\": \"South Sudan\",\n",
      "            \"&#x1F1F8&#x1F1F9\": \"S\\u00e3o Tom\\u00e9 & Pr\\u00edncipe\",\n",
      "            \"&#x1F1F8&#x1F1FB\": \"El Salvador\",\n",
      "            \"&#x1F1F8&#x1F1FD\": \"Sint Maarten\",\n",
      "            \"&#x1F1F8&#x1F1FE\": \"Syria\",\n",
      "            \"&#x1F1F8&#x1F1FF\": \"Eswatini\",\n",
      "            \"&#x1F1F9&#x1F1E6\": \"Tristan da Cunha\",\n",
      "            \"&#x1F1F9&#x1F1E8\": \"Turks & Caicos Islands\",\n",
      "            \"&#x1F1F9&#x1F1E9\": \"Chad\",\n",
      "            \"&#x1F1F9&#x1F1EB\": \"French Southern Territories\",\n",
      "            \"&#x1F1F9&#x1F1EC\": \"Togo\",\n",
      "            \"&#x1F1F9&#x1F1ED\": \"Thailand\",\n",
      "            \"&#x1F1F9&#x1F1EF\": \"Tajikistan\",\n",
      "            \"&#x1F1F9&#x1F1F0\": \"Tokelau\",\n",
      "            \"&#x1F1F9&#x1F1F1\": \"Timor-Leste\",\n",
      "            \"&#x1F1F9&#x1F1F2\": \"Turkmenistan\",\n",
      "            \"&#x1F1F9&#x1F1F3\": \"Tunisia\",\n",
      "            \"&#x1F1F9&#x1F1F4\": \"Tonga\",\n",
      "            \"&#x1F1F9&#x1F1F7\": \"Turkey\",\n",
      "            \"&#x1F1F9&#x1F1F9\": \"Trinidad & Tobago\",\n",
      "            \"&#x1F1F9&#x1F1FB\": \"Tuvalu\",\n",
      "            \"&#x1F1F9&#x1F1FC\": \"Taiwan\",\n",
      "            \"&#x1F1F9&#x1F1FF\": \"Tanzania\",\n",
      "            \"&#x1F1FA&#x1F1E6\": \"Ukraine\",\n",
      "            \"&#x1F1FA&#x1F1EC\": \"Uganda\",\n",
      "            \"&#x1F1FA&#x1F1F2\": \"U.S. Outlying Islands\",\n",
      "            \"&#x1F1FA&#x1F1F3\": \"United Nations\",\n",
      "            \"&#x1F1FA&#x1F1F8\": \"United States\",\n",
      "            \"&#x1F1FA&#x1F1FE\": \"Uruguay\",\n",
      "            \"&#x1F1FA&#x1F1FF\": \"Uzbekistan\",\n",
      "            \"&#x1F1FB&#x1F1E6\": \"Vatican City\",\n",
      "            \"&#x1F1FB&#x1F1E8\": \"St. Vincent & Grenadines\",\n",
      "            \"&#x1F1FB&#x1F1EA\": \"Venezuela\",\n",
      "            \"&#x1F1FB&#x1F1EC\": \"British Virgin Islands\",\n",
      "            \"&#x1F1FB&#x1F1EE\": \"U.S. Virgin Islands\",\n",
      "            \"&#x1F1FB&#x1F1F3\": \"Vietnam\",\n",
      "            \"&#x1F1FB&#x1F1FA\": \"Vanuatu\",\n",
      "            \"&#x1F1FC&#x1F1EB\": \"Wallis & Futuna\",\n",
      "            \"&#x1F1FC&#x1F1F8\": \"Samoa\",\n",
      "            \"&#x1F1FD&#x1F1F0\": \"Kosovo\",\n",
      "            \"&#x1F1FE&#x1F1EA\": \"Yemen\",\n",
      "            \"&#x1F1FE&#x1F1F9\": \"Mayotte\",\n",
      "            \"&#x1F1FF&#x1F1E6\": \"South Africa\",\n",
      "            \"&#x1F1FF&#x1F1F2\": \"Zambia\",\n",
      "            \"&#x1F1FF&#x1F1FC\": \"Zimbabwe\",\n",
      "            \"&#x1F30F\": \"The world\",\n",
      "            \"&#x1F3A3\": \"Phishing\",\n",
      "            \"&#x1F480;\": \"Threat intel match\",\n",
      "            \"&#x1F4E1\": \"Domain activity\",\n",
      "            \"&#x1F4F7\": \"Screenshot activity\",\n",
      "            \"&#x1F50E\": \"Search related activity\",\n",
      "            \"&#x1F512\": \"Logon activity\",\n",
      "            \"&#x1F513\": \"Logoff activity\",\n",
      "            \"&#x1F517\": \"Events Linked\",\n",
      "            \"&#x1F5B5\": \"Screensaver activity\",\n",
      "            \"&#x1F5D1\": \"Deletion activity\",\n",
      "            \"&#x1F634\": \"Activity outside of regular hours\",\n",
      "            \"&#x1F682\": \"Execution activity\",\n",
      "            \"&#x1F9CD\": \"Person\",\n",
      "            \"&#x1FAA3\": \"Storage bucket\",\n",
      "            \"&#x2620\": \"Suspicious entry\",\n",
      "            \"&#x2728\": \"New entity created\"\n",
      "        },\n",
      "        \"filter_labels\": [],\n",
      "        \"indices_metadata\": {\n",
      "            \"af23d06fb58b409a849571a18115e4ba\": {\n",
      "                \"is_legacy\": false\n",
      "            }\n",
      "        },\n",
      "        \"last_activity\": \"2022-10-05T09:48:20.427484\",\n",
      "        \"mappings\": [\n",
      "            {\n",
      "                \"field\": \"command\",\n",
      "                \"type\": \"text\"\n",
      "            },\n",
      "            {\n",
      "                \"field\": \"data_type\",\n",
      "                \"type\": \"text\"\n",
      "            },\n",
      "            {\n",
      "                \"field\": \"datetime\",\n",
      "                \"type\": \"date\"\n",
      "            },\n",
      "            {\n",
      "                \"field\": \"display_name\",\n",
      "                \"type\": \"text\"\n",
      "            },\n",
      "            {\n",
      "                \"field\": \"extra_field_1\",\n",
      "                \"type\": \"text\"\n",
      "            },\n",
      "            {\n",
      "                \"field\": \"filename\",\n",
      "                \"type\": \"text\"\n",
      "            },\n",
      "            {\n",
      "                \"field\": \"message\",\n",
      "                \"type\": \"text\"\n",
      "            },\n",
      "            {\n",
      "                \"field\": \"packages\",\n",
      "                \"type\": \"text\"\n",
      "            },\n",
      "            {\n",
      "                \"field\": \"parser\",\n",
      "                \"type\": \"text\"\n",
      "            },\n",
      "            {\n",
      "                \"field\": \"timestamp\",\n",
      "                \"type\": \"long\"\n",
      "            },\n",
      "            {\n",
      "                \"field\": \"timestamp_desc\",\n",
      "                \"type\": \"text\"\n",
      "            }\n",
      "        ],\n",
      "        \"permissions\": {\n",
      "            \"delete\": true,\n",
      "            \"public\": false,\n",
      "            \"read\": true,\n",
      "            \"write\": true\n",
      "        },\n",
      "        \"searchtemplates\": [],\n",
      "        \"sketch_labels\": [],\n",
      "        \"stats_per_timeline\": {\n",
      "            \"1\": {\n",
      "                \"count\": 4\n",
      "            }\n",
      "        },\n",
      "        \"stories\": [],\n",
      "        \"views\": []\n",
      "    },\n",
      "    \"objects\": [\n",
      "        {\n",
      "            \"active_timelines\": [\n",
      "                {\n",
      "                    \"color\": \"F37979\",\n",
      "                    \"created_at\": \"2022-10-03T16:05:59.389141\",\n",
      "                    \"datasources\": [\n",
      "                        {\n",
      "                            \"context\": \"sigma_events.csv\",\n",
      "                            \"created_at\": \"2022-10-03T16:05:59.408345\",\n",
      "                            \"data_label\": \"\",\n",
      "                            \"error_message\": \"\",\n",
      "                            \"file_on_disk\": \"/tmp/0c12b9e8d7e04ac5aa6f6c7f4166759d\",\n",
      "                            \"file_size\": 702,\n",
      "                            \"id\": 1,\n",
      "                            \"original_filename\": \"sigma_events.csv\",\n",
      "                            \"provider\": \"WebUpload\",\n",
      "                            \"status\": [\n",
      "                                {\n",
      "                                    \"created_at\": \"2022-10-03T16:06:11.196512\",\n",
      "                                    \"id\": 3,\n",
      "                                    \"status\": \"ready\",\n",
      "                                    \"updated_at\": \"2022-10-03T16:06:11.196512\"\n",
      "                                }\n",
      "                            ],\n",
      "                            \"total_file_events\": 5,\n",
      "                            \"updated_at\": \"2022-10-03T16:06:10.177291\",\n",
      "                            \"user\": {\n",
      "                                \"active\": true,\n",
      "                                \"admin\": false,\n",
      "                                \"groups\": [],\n",
      "                                \"username\": \"dev\"\n",
      "                            }\n",
      "                        }\n",
      "                    ],\n",
      "                    \"deleted\": null,\n",
      "                    \"description\": \"sigma_events\",\n",
      "                    \"id\": 1,\n",
      "                    \"label_string\": \"\",\n",
      "                    \"name\": \"sigma_events\",\n",
      "                    \"searchindex\": {\n",
      "                        \"created_at\": \"2022-10-03T16:05:59.322881\",\n",
      "                        \"deleted\": null,\n",
      "                        \"description\": \"sigma_events\",\n",
      "                        \"id\": 1,\n",
      "                        \"index_name\": \"af23d06fb58b409a849571a18115e4ba\",\n",
      "                        \"label_string\": \"[\\\"csv_jsonl\\\"]\",\n",
      "                        \"name\": \"sigma_events\",\n",
      "                        \"status\": [\n",
      "                            {\n",
      "                                \"created_at\": \"2022-10-03T16:06:11.211541\",\n",
      "                                \"id\": 4,\n",
      "                                \"status\": \"ready\",\n",
      "                                \"updated_at\": \"2022-10-03T16:06:11.211541\"\n",
      "                            }\n",
      "                        ],\n",
      "                        \"updated_at\": \"2022-10-03T16:05:59.322881\",\n",
      "                        \"user\": {\n",
      "                            \"active\": true,\n",
      "                            \"admin\": false,\n",
      "                            \"groups\": [],\n",
      "                            \"username\": \"dev\"\n",
      "                        }\n",
      "                    },\n",
      "                    \"status\": [\n",
      "                        {\n",
      "                            \"created_at\": \"2022-10-03T16:06:11.204530\",\n",
      "                            \"id\": 3,\n",
      "                            \"status\": \"ready\",\n",
      "                            \"updated_at\": \"2022-10-03T16:06:11.204530\"\n",
      "                        }\n",
      "                    ],\n",
      "                    \"updated_at\": \"2022-10-03T16:05:59.389141\",\n",
      "                    \"user\": {\n",
      "                        \"active\": true,\n",
      "                        \"admin\": false,\n",
      "                        \"groups\": [],\n",
      "                        \"username\": \"dev\"\n",
      "                    }\n",
      "                }\n",
      "            ],\n",
      "            \"all_permissions\": \"{\\\"user/dev\\\": [\\\"read\\\", \\\"write\\\", \\\"delete\\\"], \\\"is_public\\\": false}\",\n",
      "            \"created_at\": \"2022-10-03T16:05:52.851371\",\n",
      "            \"description\": \"aaa\",\n",
      "            \"graphs\": [],\n",
      "            \"id\": 1,\n",
      "            \"label_string\": \"\",\n",
      "            \"my_permissions\": \"[\\\"read\\\", \\\"write\\\", \\\"delete\\\"]\",\n",
      "            \"name\": \"aaa\",\n",
      "            \"status\": [\n",
      "                {\n",
      "                    \"created_at\": \"2022-10-03T16:05:52.851371\",\n",
      "                    \"id\": 1,\n",
      "                    \"status\": \"new\",\n",
      "                    \"updated_at\": \"2022-10-03T16:05:52.851371\"\n",
      "                }\n",
      "            ],\n",
      "            \"timelines\": [\n",
      "                {\n",
      "                    \"color\": \"F37979\",\n",
      "                    \"created_at\": \"2022-10-03T16:05:59.389141\",\n",
      "                    \"datasources\": [\n",
      "                        {\n",
      "                            \"context\": \"sigma_events.csv\",\n",
      "                            \"created_at\": \"2022-10-03T16:05:59.408345\",\n",
      "                            \"data_label\": \"\",\n",
      "                            \"error_message\": \"\",\n",
      "                            \"file_on_disk\": \"/tmp/0c12b9e8d7e04ac5aa6f6c7f4166759d\",\n",
      "                            \"file_size\": 702,\n",
      "                            \"id\": 1,\n",
      "                            \"original_filename\": \"sigma_events.csv\",\n",
      "                            \"provider\": \"WebUpload\",\n",
      "                            \"status\": [\n",
      "                                {\n",
      "                                    \"created_at\": \"2022-10-03T16:06:11.196512\",\n",
      "                                    \"id\": 3,\n",
      "                                    \"status\": \"ready\",\n",
      "                                    \"updated_at\": \"2022-10-03T16:06:11.196512\"\n",
      "                                }\n",
      "                            ],\n",
      "                            \"total_file_events\": 5,\n",
      "                            \"updated_at\": \"2022-10-03T16:06:10.177291\",\n",
      "                            \"user\": {\n",
      "                                \"active\": true,\n",
      "                                \"admin\": false,\n",
      "                                \"groups\": [],\n",
      "                                \"username\": \"dev\"\n",
      "                            }\n",
      "                        }\n",
      "                    ],\n",
      "                    \"deleted\": null,\n",
      "                    \"description\": \"sigma_events\",\n",
      "                    \"id\": 1,\n",
      "                    \"label_string\": \"\",\n",
      "                    \"name\": \"sigma_events\",\n",
      "                    \"searchindex\": {\n",
      "                        \"created_at\": \"2022-10-03T16:05:59.322881\",\n",
      "                        \"deleted\": null,\n",
      "                        \"description\": \"sigma_events\",\n",
      "                        \"id\": 1,\n",
      "                        \"index_name\": \"af23d06fb58b409a849571a18115e4ba\",\n",
      "                        \"label_string\": \"[\\\"csv_jsonl\\\"]\",\n",
      "                        \"name\": \"sigma_events\",\n",
      "                        \"status\": [\n",
      "                            {\n",
      "                                \"created_at\": \"2022-10-03T16:06:11.211541\",\n",
      "                                \"id\": 4,\n",
      "                                \"status\": \"ready\",\n",
      "                                \"updated_at\": \"2022-10-03T16:06:11.211541\"\n",
      "                            }\n",
      "                        ],\n",
      "                        \"updated_at\": \"2022-10-03T16:05:59.322881\",\n",
      "                        \"user\": {\n",
      "                            \"active\": true,\n",
      "                            \"admin\": false,\n",
      "                            \"groups\": [],\n",
      "                            \"username\": \"dev\"\n",
      "                        }\n",
      "                    },\n",
      "                    \"status\": [\n",
      "                        {\n",
      "                            \"created_at\": \"2022-10-03T16:06:11.204530\",\n",
      "                            \"id\": 3,\n",
      "                            \"status\": \"ready\",\n",
      "                            \"updated_at\": \"2022-10-03T16:06:11.204530\"\n",
      "                        }\n",
      "                    ],\n",
      "                    \"updated_at\": \"2022-10-03T16:05:59.389141\",\n",
      "                    \"user\": {\n",
      "                        \"active\": true,\n",
      "                        \"admin\": false,\n",
      "                        \"groups\": [],\n",
      "                        \"username\": \"dev\"\n",
      "                    }\n",
      "                }\n",
      "            ],\n",
      "            \"updated_at\": \"2022-10-03T16:05:52.851371\",\n",
      "            \"user\": {\n",
      "                \"active\": true,\n",
      "                \"admin\": false,\n",
      "                \"groups\": [],\n",
      "                \"username\": \"dev\"\n",
      "            }\n",
      "        }\n",
      "    ]\n",
      "}\n"
     ]
    }
   ],
   "source": []
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Get Sigma rules"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'API Client: 20221005\\nTS Backend: 20210602'"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "ts_client.version"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Deprecated, please use list_sigmarules() instead\n"
     ]
    }
   ],
   "source": [
    "sigme_rule = ts_client.list_sigmarules(as_pandas=True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>author</th>\n",
       "      <th>created_at</th>\n",
       "      <th>date</th>\n",
       "      <th>description</th>\n",
       "      <th>detection</th>\n",
       "      <th>falsepositives</th>\n",
       "      <th>file_name</th>\n",
       "      <th>id</th>\n",
       "      <th>level</th>\n",
       "      <th>logsource</th>\n",
       "      <th>modified</th>\n",
       "      <th>references</th>\n",
       "      <th>rule_uuid</th>\n",
       "      <th>rule_yaml</th>\n",
       "      <th>search_query</th>\n",
       "      <th>status</th>\n",
       "      <th>tags</th>\n",
       "      <th>title</th>\n",
       "      <th>updated_at</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>None</td>\n",
       "      <td>2022-10-04 15:10:27.697184</td>\n",
       "      <td>2022/10/04</td>\n",
       "      <td>Detects suspicious FOOBAR</td>\n",
       "      <td>{'condition': 'keywords', 'keywords': ['*fooba...</td>\n",
       "      <td>[Unknown]</td>\n",
       "      <td>N/A</td>\n",
       "      <td>7f4d2d41-19f9-4427-9227-1ef288247f52</td>\n",
       "      <td>medium</td>\n",
       "      <td>{'product': 'google_workspace', 'service': 'go...</td>\n",
       "      <td>2022/10/04</td>\n",
       "      <td>[https://]</td>\n",
       "      <td>7f4d2d41-19f9-4427-9227-1ef288247f52</td>\n",
       "      <td>title: Foobar\\nid: 7f4d2d41-19f9-4427-9227-1ef...</td>\n",
       "      <td>*foobar2*</td>\n",
       "      <td>experimental</td>\n",
       "      <td>[None]</td>\n",
       "      <td>Foobar</td>\n",
       "      <td>2022-10-04 16:40:49.916821</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>None</td>\n",
       "      <td>2022-10-04 16:48:25.620548</td>\n",
       "      <td>2022/10/04</td>\n",
       "      <td>Detects suspicious FOOBAR</td>\n",
       "      <td>{'condition': 'keywords', 'keywords': ['*fooba...</td>\n",
       "      <td>[Unknown]</td>\n",
       "      <td>N/A</td>\n",
       "      <td>f71185d4-f2a2-4054-85b3-94c3ac9ce438</td>\n",
       "      <td>medium</td>\n",
       "      <td>{'category': 'process_creation', 'product': 'l...</td>\n",
       "      <td>2022/10/04</td>\n",
       "      <td>[https://]</td>\n",
       "      <td>f71185d4-f2a2-4054-85b3-94c3ac9ce438</td>\n",
       "      <td>title: Foobar\\nid: f71185d4-f2a2-4054-85b3-94c...</td>\n",
       "      <td>(data_type:(\"shell:zsh:history\" OR \"bash:histo...</td>\n",
       "      <td>experimental</td>\n",
       "      <td>[None]</td>\n",
       "      <td>Foobar</td>\n",
       "      <td>2022-10-04 16:48:25.620548</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>None</td>\n",
       "      <td>2022-10-04 16:49:04.403246</td>\n",
       "      <td>2022/10/04</td>\n",
       "      <td>Detects suspicious FOOBAR</td>\n",
       "      <td>{'condition': 'keywords', 'keywords': ['*zmap*']}</td>\n",
       "      <td>[Unknown]</td>\n",
       "      <td>N/A</td>\n",
       "      <td>1289ad6d-1801-44aa-94f6-e16e596028b5</td>\n",
       "      <td>medium</td>\n",
       "      <td>{'category': 'clamav', 'product': 'linux'}</td>\n",
       "      <td>2022/10/04</td>\n",
       "      <td>[https://]</td>\n",
       "      <td>1289ad6d-1801-44aa-94f6-e16e596028b5</td>\n",
       "      <td>title: Foobar\\nid: 1289ad6d-1801-44aa-94f6-e16...</td>\n",
       "      <td>*zmap*</td>\n",
       "      <td>experimental</td>\n",
       "      <td>[None]</td>\n",
       "      <td>Foobar</td>\n",
       "      <td>2022-10-04 16:49:04.403246</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "  author                  created_at        date                description  \\\n",
       "0   None  2022-10-04 15:10:27.697184  2022/10/04  Detects suspicious FOOBAR   \n",
       "1   None  2022-10-04 16:48:25.620548  2022/10/04  Detects suspicious FOOBAR   \n",
       "2   None  2022-10-04 16:49:04.403246  2022/10/04  Detects suspicious FOOBAR   \n",
       "\n",
       "                                           detection falsepositives file_name  \\\n",
       "0  {'condition': 'keywords', 'keywords': ['*fooba...      [Unknown]       N/A   \n",
       "1  {'condition': 'keywords', 'keywords': ['*fooba...      [Unknown]       N/A   \n",
       "2  {'condition': 'keywords', 'keywords': ['*zmap*']}      [Unknown]       N/A   \n",
       "\n",
       "                                     id   level  \\\n",
       "0  7f4d2d41-19f9-4427-9227-1ef288247f52  medium   \n",
       "1  f71185d4-f2a2-4054-85b3-94c3ac9ce438  medium   \n",
       "2  1289ad6d-1801-44aa-94f6-e16e596028b5  medium   \n",
       "\n",
       "                                           logsource    modified  references  \\\n",
       "0  {'product': 'google_workspace', 'service': 'go...  2022/10/04  [https://]   \n",
       "1  {'category': 'process_creation', 'product': 'l...  2022/10/04  [https://]   \n",
       "2         {'category': 'clamav', 'product': 'linux'}  2022/10/04  [https://]   \n",
       "\n",
       "                              rule_uuid  \\\n",
       "0  7f4d2d41-19f9-4427-9227-1ef288247f52   \n",
       "1  f71185d4-f2a2-4054-85b3-94c3ac9ce438   \n",
       "2  1289ad6d-1801-44aa-94f6-e16e596028b5   \n",
       "\n",
       "                                           rule_yaml  \\\n",
       "0  title: Foobar\\nid: 7f4d2d41-19f9-4427-9227-1ef...   \n",
       "1  title: Foobar\\nid: f71185d4-f2a2-4054-85b3-94c...   \n",
       "2  title: Foobar\\nid: 1289ad6d-1801-44aa-94f6-e16...   \n",
       "\n",
       "                                        search_query        status    tags  \\\n",
       "0                                          *foobar2*  experimental  [None]   \n",
       "1  (data_type:(\"shell:zsh:history\" OR \"bash:histo...  experimental  [None]   \n",
       "2                                             *zmap*  experimental  [None]   \n",
       "\n",
       "    title                  updated_at  \n",
       "0  Foobar  2022-10-04 16:40:49.916821  \n",
       "1  Foobar  2022-10-04 16:48:25.620548  \n",
       "2  Foobar  2022-10-04 16:49:04.403246  "
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "sigme_rule"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [],
   "source": [
    "new_rule = '''\n",
    "title: Installation of foobar\n",
    "id: bb1e0d1d-cd13-4b65-bf7e-69b4e740266ba\n",
    "description: Detects suspicious installation of foobar\n",
    "references:\n",
    "    - https://samle.com/foobar\n",
    "author: Alexander Jaeger\n",
    "date: 2020/12/10\n",
    "modified: 2020/12/10\n",
    "logsource:\n",
    "    product: linux\n",
    "    service: shell\n",
    "detection:\n",
    "    keywords:\n",
    "        # Generic suspicious commands\n",
    "        - '*apt-get install foobar*'\n",
    "    condition: keywords\n",
    "falsepositives:\n",
    "    - Unknown\n",
    "level: high\n",
    "'''"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [],
   "source": [
    "result = ts_client.create_sigmarule(new_rule)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'experimental'"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "result.status"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Provide a path where a rule is stored\n",
    "\n",
    "RULE_File = '/usr/local/google/home/jaegeral/dev/timesketch/data/sigma/rules/lnx_susp_zmap.yml'\n",
    "\n",
    "with open(RULE_File, 'r') as sigma_rule_file:\n",
    "        sigma_rule = sigma_rule_file.read()\n",
    "        \n",
    "#sigma_config = sigma_configuration.SigmaConfiguration(sigma_config)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "\"title: Suspicious Installation of ZMap\\nid: 5266a592-b793-11ea-b3de-0242ac130004\\ndescription: Detects suspicious installation of ZMap\\nreferences:\\n    - https://rmusser.net/docs/ATT&CK-Stuff/ATT&CK/Discovery.html\\nauthor: Alexander Jaeger\\ndate: 2020/06/26\\nmodified: 2020/06/26\\ntags:\\n    - attack.discovery\\n    - attack.t1046\\nlogsource:\\n    product: linux\\n    service: shell\\ndetection:\\n    keywords:\\n        # Generic suspicious commands\\n        - '*apt-get install zmap*'\\n    condition: keywords\\nfalsepositives:\\n    - Unknown\\nlevel: high\\n\""
      ]
     },
     "execution_count": 26,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Check that the file is actually read\n",
    "sigma_rule"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Deprecated, use SigmaRule object instead\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "'(data_type:(\"shell:zsh:history\" OR \"bash:history:command\" OR \"apt:history:line\" OR \"selinux:line\") AND \"apt-get install zmap\")'"
      ]
     },
     "execution_count": 30,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "parsed_rule = ts_client.parse_sigmarule_by_text(sigma_rule)\n",
    "parsed_rule.search_query"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Failed response: [403] Rule 5266a592-b793-11ea-b3de-0242ac130004 was already found in the database FORBIDDEN\n",
      "Failed response: [403] Rule 5266a592-b793-11ea-b3de-0242ac130004 was already found in the database FORBIDDEN\n",
      "Failed response: [403] Rule 5266a592-b793-11ea-b3de-0242ac130004 was already found in the database FORBIDDEN\n",
      "Failed response: [403] Rule 5266a592-b793-11ea-b3de-0242ac130004 was already found in the database FORBIDDEN\n",
      "Failed response: [403] Rule 5266a592-b793-11ea-b3de-0242ac130004 was already found in the database FORBIDDEN\n"
     ]
    },
    {
     "ename": "RuntimeError",
     "evalue": "Unable to create a new Sigma Rule.",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31m---------------------------------------------------------------------------\u001b[0m",
      "\u001b[0;31mRuntimeError\u001b[0m                              Traceback (most recent call last)",
      "Cell \u001b[0;32mIn [32], line 1\u001b[0m\n\u001b[0;32m----> 1\u001b[0m \u001b[43mts_client\u001b[49m\u001b[38;5;241;43m.\u001b[39;49m\u001b[43mcreate_sigmarule\u001b[49m\u001b[43m(\u001b[49m\u001b[43msigma_rule\u001b[49m\u001b[43m)\u001b[49m\n",
      "File \u001b[0;32m~/dev/timesketch/api_client/python/timesketch_api_client/client.py:678\u001b[0m, in \u001b[0;36mTimesketchApi.create_sigmarule\u001b[0;34m(self, rule_yaml)\u001b[0m\n\u001b[1;32m    675\u001b[0m     retry_count \u001b[39m+\u001b[39m\u001b[39m=\u001b[39m \u001b[39m1\u001b[39m\n\u001b[1;32m    677\u001b[0m     \u001b[39mif\u001b[39;00m retry_count \u001b[39m>\u001b[39m\u001b[39m=\u001b[39m \u001b[39mself\u001b[39m\u001b[39m.\u001b[39mDEFAULT_RETRY_COUNT:\n\u001b[0;32m--> 678\u001b[0m         \u001b[39mraise\u001b[39;00m \u001b[39mRuntimeError\u001b[39;00m(\u001b[39m\"\u001b[39m\u001b[39mUnable to create a new Sigma Rule.\u001b[39m\u001b[39m\"\u001b[39m)\n\u001b[1;32m    680\u001b[0m rule_uuid \u001b[39m=\u001b[39m objects[\u001b[39m0\u001b[39m][\u001b[39m\"\u001b[39m\u001b[39mrule_uuid\u001b[39m\u001b[39m\"\u001b[39m]\n\u001b[1;32m    681\u001b[0m \u001b[39mreturn\u001b[39;00m \u001b[39mself\u001b[39m\u001b[39m.\u001b[39mget_sigmarule(rule_uuid)\n",
      "\u001b[0;31mRuntimeError\u001b[0m: Unable to create a new Sigma Rule."
     ]
    }
   ],
   "source": [
    "ts_client.create_sigmarule(sigma_rule)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# you can only add the same rule once:\n",
    "\n",
    "ts_client.create_sigmarule(sigma_rule)\n",
    "\n",
    "# will give you:\n",
    "# Failed response: [403] Rule 5266a592-b793-11ea-b3de-0242ac130004 was already found in the database FORBIDDEN"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3.10.7 ('.venv': pipenv)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.7"
  },
  "orig_nbformat": 4,
  "vscode": {
   "interpreter": {
    "hash": "a34c381f30693eab9e91429498d23c5bee65cfe0188b27a9a25a7dd65b2078b0"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}
